3 ms·
> when I send a parameterized query to PostgreSQL or MS SQL Server You're not sending a parameterized query. The libraries are creating prepared statements und
by tomnipotent 5y ago
> when I send a parameterized query to PostgreSQL or MS SQL Server
You're not sending a parameterized query. The libraries are creating prepared statements under the hood, and managing them for you. This generally requires one call to prepare the statement and fetch some sort of handle, and then executing the statement with the handle from the first call.
Part of the confusion is that it's common to see SQL libraries offer an API to parametrize queries using some sort of placeholder in the query, but it's really just a facade to perform local string interpolation along with some sort of vendor-specific sanitation scheme.
- hn_throwaway_99 5y ago> This generally requires one call to prepare the statement and fetch some sort of handle, and then executing the statement with the handle from the first call. Not always. The Node `pg` module pipelines down the commands on the connection: it sends a `prepare` command, then a `bind` command, then an `execute` command. Yes, it uses prepared statements under the hood, but there is no wire round trip between prepare and bind.
- tomnipotent 5y agoLooks like Postgres 14 added pipeline mode in libpq, good to know!